What AI Agent Governance Actually Looks Like

Everyone is talking about AI agent governance. NIST just launched an initiative to develop standards for it. Enterprise security teams are adding "how do you govern your AI agents?" to vendor questionnaires. Gartner predicts that by 2028, a third of enterprise software will include agentic AI — up from less than one percent today. But when you look for concrete answers about what agent governance actually involves — what gets checked, when it gets checked, how enforcement works in a real system — you find almost nothing. The conversation is stuck at the level of principles: "agents should be transparent," "agents need human oversight," "agents must operate within boundaries." These are correct and completely insufficient. They're the equivalent of saying "software should be secure" without explaining authentication, authorization, or encryption. This post is about the mechanics. What does it actually look like to govern an AI agent — not in theory, not in a framework document, but in a